@event4u/agent-config 14.5.0 → 14.7.0

package/dist/cli-delegate/{chunk-ZPSXJTLI.js → chunk-JZ4NR2TW.js}

@@ -1,4 +1,14 @@
 import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url);
+import {
+  readHookStdin
+} from "./chunk-F7DQWYR5.js";
+import {
+  has_stable_session_id,
+  prune_legacy_state_file,
+  prune_stale_session_states,
+  session_state_file,
+  update_json_under_lock
+} from "./chunk-6EOCNQAM.js";
 
 // src/scripts/_lib/secret_detector.ts
 var ENTROPY_MIN_TOKEN_LENGTH = 20;
@@ -213,6 +223,20 @@ var CAPSULE_SCHEMA_VERSION = 3;
 function isShortLine(value, max) {
   return typeof value === "string" && value.length > 0 && value.length <= max && !value.includes("\n");
 }
+function isPathRef(value) {
+  return typeof value === "string" && value.length > 0 && !/\s/.test(value);
+}
+function checkPathRefList(errors, field, value, max, required) {
+  checkList(errors, field, value, max, required);
+  if (!Array.isArray(value)) return;
+  if (value.some((x) => !isShortLine(x, max))) return;
+  const bad = value.filter((x) => !isPathRef(x));
+  if (bad.length === 0) return;
+  const shown = bad.slice(0, 3).map((x) => JSON.stringify(String(x))).join(", ");
+  errors.push(
+    `${field} carries ${bad.length} entr${bad.length === 1 ? "y" : "ies"} that are prose, not path refs: ${shown}${bad.length > 3 ? ", \u2026" : ""} \u2014 write the path (src/generated/api.ts, ../other-worktree/) or drop the entry; a sentence naming a file cannot be compared against a write target, and being comparable is the whole reason this is a field rather than a line of prose`
+  );
+}
 function checkList(errors, field, value, max, required) {
   if (value === void 0) {
     if (required) errors.push(`${field} is required`);
@@ -402,7 +426,7 @@ function validateRecycleEnvelope(input) {
   checkList(errors, "decisions", e["decisions"], MAX_LINE_CHARS, false);
   errors.push(...decisionTagErrors(e["decisions"]));
   checkList(errors, "constraints", e["constraints"], MAX_LINE_CHARS, false);
-  checkList(errors, "do_not_touch", e["do_not_touch"], MAX_REF_CHARS, false);
+  checkPathRefList(errors, "do_not_touch", e["do_not_touch"], MAX_REF_CHARS, false);
   checkList(errors, "open_worker_envelopes", e["open_worker_envelopes"], MAX_REF_CHARS, false);
   checkList(errors, "artifact_paths", e["artifact_paths"], MAX_REF_CHARS, false);
   checkList(errors, "suggested_skills", e["suggested_skills"], MAX_REF_CHARS, false);
@@ -455,7 +479,335 @@ function validateAssumption(input, label = "assumption") {
   return errors;
 }
 
+// src/scripts/before_complete_hook.ts
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+var STATE_FILE = path.join("agents", "state", "verify-before-complete.json");
+var STATE_DIR = path.join("agents", "state", "verify-before-complete");
+var STATE_RETENTION_DAYS = 7;
+function statePathFor(session_id) {
+  return session_state_file(STATE_DIR, session_id);
+}
+var COMMAND_TOOLS = /* @__PURE__ */ new Set([
+  "launch-process",
+  "launch_process",
+  // Augment
+  "Bash",
+  "BashTool",
+  // Claude Code
+  "run-process",
+  "runProcess",
+  // variants
+  "shell",
+  "execute_shell",
+  // generic / Cline
+  "RunShellCommand"
+  // Cursor
+]);
+var _VERIFICATION_RE = new RegExp(
+  "(?:^|[\\s;&|`(])(task\\s+(?:ci|test|tests|lint|check|qa|phpstan|rector|ecs|pest|pytest)|(?:\\./|\\.venv/bin/|vendor/bin/)?(?:pest|phpunit|phpstan|psalm|rector|ecs)\\b|(?:python3?|\\.venv/bin/python3?)\\s+-m\\s+pytest|pytest\\b|(?:npm|pnpm|yarn|bun)\\s+(?:run\\s+)?(?:test|check|lint|typecheck|tsc)|cargo\\s+(?:test|check|clippy)|go\\s+test|make\\s+(?:test|check|lint)|composer\\s+(?:test|check|lint|phpstan)|(?:php\\s+)?artisan\\s+test)",
+  "i"
+);
+function _now() {
+  return (/* @__PURE__ */ new Date()).toISOString().replace(/\.\d{3}Z$/, "+00:00");
+}
+function _empty_state() {
+  return {
+    schema_version: 1,
+    session_id: "",
+    turn_started_at: null,
+    last_verification: null,
+    verifications_this_turn: 0,
+    verifications_this_session: 0,
+    last_stop_at: null,
+    verified_this_turn: false,
+    ci_saw_pending: false,
+    nonevidence_this_turn: 0,
+    // Round 7 § Phase 1 — the last CI read, SESSION-scoped on purpose. Every
+    // other counter here is turn-scoped because a stale POSITIVE would wrongly
+    // vouch ("I verified"). This one is a NEGATIVE ("CI was not settled"), and a
+    // stale negative only ever refuses more often — so surviving the turn
+    // boundary preserves the freshness invariant rather than bypassing it. It
+    // has to survive it: the measured failure is a completion claim in a LATER
+    // turn than the poll it rests on.
+    ci_last: null,
+    checked_at: _now()
+  };
+}
+function _extract_command(payload) {
+  const toolRaw = payload["tool_name"] || payload["toolName"] || payload["tool"];
+  if (!(typeof toolRaw === "string" && COMMAND_TOOLS.has(toolRaw))) {
+    return [typeof toolRaw === "string" ? toolRaw : null, null];
+  }
+  const tool = toolRaw;
+  const ti = payload["tool_input"];
+  if (typeof ti === "object" && ti !== null && !Array.isArray(ti)) {
+    for (const key of ["command", "cmd", "shell_command"]) {
+      const v = ti[key];
+      if (typeof v === "string" && v) {
+        return [tool, v];
+      }
+    }
+  }
+  for (const key of ["command", "cmd"]) {
+    const v = payload[key];
+    if (typeof v === "string" && v) {
+      return [tool, v];
+    }
+  }
+  return [tool, null];
+}
+function _is_verification(command) {
+  return _VERIFICATION_RE.test(command) || isCiPoll(command);
+}
+var _VACUOUS_PATTERNS = [
+  // gh pr checks / gh run — no checks registered at all.
+  /\b0\s+(?:checks?|runs?)\b/i,
+  // Test runners reporting an empty run.
+  /\bno tests? (?:ran|found|to run|were run)\b/i,
+  /\bNo test files found\b/i,
+  /\b0\s+pass(?:ed|ing)?\b[\s,|·]*\b0\s+fail(?:ed|ing|ures)?\b/i,
+  /\bTests?\s+0\s+passed\b/i,
+  /\bRan 0 tests?\b/i,
+  // Linters / scanners with an empty target set.
+  /\bno files? (?:matched|to (?:lint|check|scan)|found)\b/i,
+  /\b0\s+files?\s+(?:checked|scanned|linted)\b/i,
+  /\bnothing to check\b/i
+];
+function isVacuousOutput(output) {
+  const text = output.trim();
+  if (!text) {
+    return false;
+  }
+  const lines = text.split("\n").filter((l) => l.trim());
+  return lines.every((l) => _VACUOUS_PATTERNS.some((re) => re.test(l)));
+}
+var _CI_POLL_RE = /\bgh\s+(?:pr\s+checks|run\s+(?:watch|list|view))\b/i;
+function isCiPoll(command) {
+  return _CI_POLL_RE.test(command);
+}
+function pendingCount(output) {
+  const m = /(\d+)\s+(?:checks? )?pending\b/i.exec(output) ?? /\bpending[:=]\s*(\d+)/i.exec(output);
+  if (m?.[1] !== void 0) {
+    return Number(m[1]);
+  }
+  const rows = output.match(/^\S.*\b(pending|in_progress|queued)\b/gim);
+  if (rows) {
+    return rows.length;
+  }
+  if (/\bno checks reported\b/i.test(output)) {
+    return null;
+  }
+  if (/^\S+\s+(pass|fail|skipping|successful|failing)\b/im.test(output)) {
+    return 0;
+  }
+  return null;
+}
+function _extract_output(payload) {
+  for (const key of ["tool_response", "toolResponse", "output", "stdout", "result"]) {
+    const v = payload[key];
+    if (typeof v === "string") {
+      return v;
+    }
+    if (v !== null && typeof v === "object") {
+      return JSON.stringify(v);
+    }
+  }
+  return null;
+}
+function _reset_turn(state, session_id) {
+  state["session_id"] = session_id || state["session_id"] || "";
+  state["turn_started_at"] = _now();
+  state["verifications_this_turn"] = 0;
+  state["verified_this_turn"] = false;
+  state["ci_saw_pending"] = false;
+  state["nonevidence_this_turn"] = 0;
+  return state;
+}
+function _asInt(v) {
+  if (!v) {
+    return 0;
+  }
+  if (typeof v === "number") {
+    return Math.trunc(v);
+  }
+  const n = Number(v);
+  return Number.isFinite(n) ? Math.trunc(n) : 0;
+}
+function _update(state, event, envelope) {
+  const session_id = envelope["session_id"] || state["session_id"] || "";
+  if (session_id && session_id !== state["session_id"]) {
+    state["session_id"] = session_id;
+    state["verifications_this_session"] = 0;
+    state["ci_last"] = null;
+    state = _reset_turn(state, session_id);
+  }
+  let payload = envelope["payload"];
+  if (!(typeof payload === "object" && payload !== null && !Array.isArray(payload))) {
+    payload = {};
+  }
+  const pl = payload;
+  if (event === "session_start" || event === "user_prompt_submit") {
+    state = _reset_turn(state, session_id);
+  } else if (event === "post_tool_use") {
+    const [tool, cmd] = _extract_command(pl);
+    if (cmd && _is_verification(cmd)) {
+      const output = _extract_output(pl);
+      const vacuous = output !== null && isVacuousOutput(output);
+      let counts = !vacuous;
+      if (isCiPoll(cmd)) {
+        const pending = output === null ? null : pendingCount(output);
+        if (pending !== null && pending > 0) {
+          state["ci_saw_pending"] = true;
+          counts = false;
+        } else if (pending === 0) {
+          counts = !vacuous && state["ci_saw_pending"] === true;
+        } else {
+          counts = false;
+        }
+        state["ci_last"] = {
+          at: _now(),
+          command: cmd.slice(0, 512),
+          pending,
+          settled: pending === 0 && counts === true
+        };
+      }
+      state["last_verification"] = {
+        command: cmd.slice(0, 512),
+        tool,
+        at: _now(),
+        platform: envelope["platform"] || "",
+        vacuous,
+        counted: counts
+      };
+      if (counts) {
+        state["verifications_this_turn"] = _asInt(state["verifications_this_turn"]) + 1;
+        state["verifications_this_session"] = _asInt(state["verifications_this_session"]) + 1;
+        state["verified_this_turn"] = true;
+      } else {
+        state["nonevidence_this_turn"] = _asInt(state["nonevidence_this_turn"]) + 1;
+      }
+    }
+  } else if (event === "stop") {
+    state["last_stop_at"] = _now();
+  }
+  state["checked_at"] = _now();
+  return state;
+}
+function run(stdin_text, options) {
+  const { consumer_root } = options;
+  const verbose = options.verbose ?? false;
+  let envelope = {};
+  if (stdin_text.trim()) {
+    try {
+      const decoded = JSON.parse(stdin_text);
+      if (typeof decoded === "object" && decoded !== null && !Array.isArray(decoded)) {
+        envelope = decoded;
+      }
+    } catch {
+      envelope = {};
+    }
+  }
+  const event = envelope["event"] || "";
+  const session_id = typeof envelope["session_id"] === "string" ? envelope["session_id"] : "";
+  if (!has_stable_session_id(session_id)) {
+    if (verbose) {
+      process.stderr.write(
+        "verify-before-complete-hook: no session_id \u2014 running stateless, nothing recorded\n"
+      );
+    }
+    return 0;
+  }
+  const target = path.join(consumer_root, statePathFor(session_id));
+  let state = {};
+  const outcome = update_json_under_lock(target, (loaded) => {
+    state = _update({ ..._empty_state(), ...loaded }, event, envelope);
+    return state;
+  });
+  if (outcome === "failed") {
+    if (verbose) {
+      process.stderr.write("verify-before-complete-hook: state write failed\n");
+    }
+    return 0;
+  }
+  if (event === "session_start" || event === "user_prompt_submit") {
+    prune_legacy_state_file(path.join(consumer_root, STATE_FILE));
+    prune_stale_session_states(
+      path.join(consumer_root, STATE_DIR),
+      Date.now(),
+      STATE_RETENTION_DAYS
+    );
+  }
+  if (verbose) {
+    process.stderr.write(
+      `verify-before-complete-hook: event=${event} verified_this_turn=${pyRepr(state["verified_this_turn"])} verifications_this_turn=${pyRepr(state["verifications_this_turn"])}
+`
+    );
+  }
+  return 0;
+}
+function pyRepr(value) {
+  if (value === null || value === void 0) {
+    return "None";
+  }
+  if (typeof value === "boolean") {
+    return value ? "True" : "False";
+  }
+  return String(value);
+}
+function parse_args(argv) {
+  let platform = "generic";
+  let verbose = false;
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+    if (arg === "--platform") {
+      platform = argv[i + 1] ?? "generic";
+      i += 1;
+    } else if (arg !== void 0 && arg.startsWith("--platform=")) {
+      platform = arg.slice("--platform=".length);
+    } else if (arg === "--verbose") {
+      verbose = true;
+    }
+  }
+  return { platform, verbose };
+}
+function _readStdin() {
+  return readHookStdin();
+}
+function main(argv) {
+  const args = parse_args(argv ?? process.argv.slice(2));
+  return run(_readStdin(), { consumer_root: process.cwd(), verbose: args.verbose });
+}
+function _isCliEntry() {
+  if (true) {
+    return false;
+  }
+  if (process.argv[1] === void 0) {
+    return false;
+  }
+  const argvUrl = pathToFileURL(path.resolve(process.argv[1])).href;
+  if (import.meta.url === argvUrl) {
+    return true;
+  }
+  try {
+    const here = fs.realpathSync(fileURLToPath(import.meta.url));
+    const argv = fs.realpathSync(path.resolve(process.argv[1]));
+    return here === argv;
+  } catch {
+    return false;
+  }
+}
+var isCliEntry = _isCliEntry();
+if (isCliEntry) {
+  process.exit(main(process.argv.slice(2)));
+}
+
 export {
+  statePathFor,
+  isVacuousOutput,
+  isCiPoll,
+  pendingCount,
   CAPSULE_SCHEMA_VERSION,
   scanEnvelopeDirectives,
   wrapAsPriorSessionData,

package/dist/cli-delegate/chunk-MWRD5YOH.js

@@ -0,0 +1,100 @@
+import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url);
+
+// src/scripts/_lib/fs_atomic.ts
+import fs from "node:fs";
+import path from "node:path";
+import { randomBytes } from "node:crypto";
+function _normalize_encoding(encoding) {
+  const compact = encoding.toLowerCase().replace(/[-_\s]/g, "");
+  const candidates = [encoding, compact];
+  if (compact === "latin1" || compact === "iso88591") candidates.push("latin1");
+  if (compact === "utf8") candidates.push("utf8");
+  if (compact === "utf16le" || compact === "utf16") candidates.push("utf16le");
+  if (compact === "usascii") candidates.push("ascii");
+  for (const c of candidates) {
+    if (Buffer.isEncoding(c)) return c;
+  }
+  throw new Error(`unknown encoding: ${encoding}`);
+}
+function write_atomic(p, data, options = {}) {
+  const encoding = options.encoding ?? "utf-8";
+  const target = path.normalize(p);
+  const parent = path.dirname(target);
+  fs.mkdirSync(parent, { recursive: true });
+  let payload;
+  if (typeof data === "string") {
+    payload = Buffer.from(data, _normalize_encoding(encoding));
+  } else if (data instanceof Uint8Array) {
+    payload = Buffer.from(data);
+  } else {
+    throw new TypeError(
+      `write_atomic: data must be str or bytes, got ${typeof data}`
+    );
+  }
+  let fd = null;
+  let tmp_path = "";
+  for (let attempt = 0; attempt < 32; attempt += 1) {
+    tmp_path = path.join(
+      parent,
+      `.${path.basename(target)}.tmp.${randomBytes(6).toString("hex")}`
+    );
+    try {
+      fd = fs.openSync(tmp_path, "wx", 384);
+      break;
+    } catch (err) {
+      if (err.code === "EEXIST") continue;
+      throw err;
+    }
+  }
+  if (fd === null) {
+    throw new Error("write_atomic: could not create a unique temp file");
+  }
+  let closed = false;
+  try {
+    let offset = 0;
+    while (offset < payload.length) {
+      offset += fs.writeSync(fd, payload, offset, payload.length - offset);
+    }
+    try {
+      fs.fsyncSync(fd);
+    } catch {
+    }
+    fs.closeSync(fd);
+    closed = true;
+    fs.renameSync(tmp_path, target);
+  } catch (err) {
+    if (!closed) {
+      try {
+        fs.closeSync(fd);
+      } catch {
+      }
+    }
+    try {
+      fs.unlinkSync(tmp_path);
+    } catch {
+    }
+    throw err;
+  }
+  _fsync_dir(parent);
+  return target;
+}
+function _fsync_dir(directory) {
+  let dir_fd;
+  try {
+    dir_fd = fs.openSync(directory, fs.constants.O_RDONLY);
+  } catch {
+    return;
+  }
+  try {
+    try {
+      fs.fsyncSync(dir_fd);
+    } catch {
+    }
+  } finally {
+    fs.closeSync(dir_fd);
+  }
+}
+
+export {
+  write_atomic
+};

package/dist/cli-delegate/{chunk-GRRPEPRN.js → chunk-T7L2QK3K.js}

@@ -58,6 +58,7 @@ var _VERSION_RE = /^\s*agent_config_version\s*:\s*"?([^"\s]+)"?\s*$/;
 var _SCHEMA_RE = /^\s*schema_version\s*:\s*(\d+)\s*$/;
 var _LAYOUT_RE = /^\s*install_layout_version\s*:\s*(\d+)\s*$/;
 var _INSTALLED_AT_RE = /^\s*installed_at\s*:\s*"?([^"\s]+)"?\s*$/;
+var _FINGERPRINT_RE = /^\s*host_layer_fingerprint\s*:\s*"?([0-9a-f]{64})"?\s*$/;
 var _TOOL_RE = /^\s*-\s*([A-Za-z0-9_\-.]+)\s*$/;
 function expanduser(p) {
   if (p === "~") {
@@ -123,6 +124,12 @@ function read_lockfile(path2) {
       in_tools = false;
       continue;
     }
+    const fp_m = _FINGERPRINT_RE.exec(raw_line);
+    if (fp_m) {
+      data.host_layer_fingerprint = fp_m[1];
+      in_tools = false;
+      continue;
+    }
     if (raw_line.trim().startsWith("tools:")) {
       in_tools = true;
       continue;
@@ -145,14 +152,17 @@ function splitlines(text) {
   }
   return parts;
 }
-function _render(version, tools, installed_at) {
+function _render(version, tools, installed_at, fingerprint) {
   const lines = [
     `schema_version: ${SCHEMA_VERSION}`,
     `install_layout_version: ${INSTALL_LAYOUT_VERSION}`,
     `agent_config_version: "${version}"`,
-    `installed_at: "${installed_at}"`,
-    "tools:"
+    `installed_at: "${installed_at}"`
   ];
+  if (fingerprint) {
+    lines.push(`host_layer_fingerprint: "${fingerprint}"`);
+  }
+  lines.push("tools:");
   for (const tool of tools) {
     lines.push(`  - ${tool}`);
   }
@@ -162,7 +172,12 @@ function write_lockfile(version, tools, options = {}) {
   const target = options.path ?? lockfile_path();
   fs.mkdirSync(path.dirname(target), { recursive: true });
   const stamp = strftime_iso_z(options.now ?? /* @__PURE__ */ new Date());
-  const rendered = _render(version, sorted_unique(tools), stamp);
+  const rendered = _render(
+    version,
+    sorted_unique(tools),
+    stamp,
+    options.host_layer_fingerprint ?? null
+  );
   const parent = path.dirname(target);
   const { fd, tmp_name } = mkstemp(parent, ".installed.lock.");
   try {
@@ -218,7 +233,11 @@ function migrate_layout(options = {}) {
   const version = existing.agent_config_version || current_package_version();
   const tools = [...existing.tools ?? []];
   const when = options.now ?? _parse_installed_at(existing.installed_at);
-  write_lockfile(version, tools, { path: target, now: when });
+  write_lockfile(version, tools, {
+    path: target,
+    now: when,
+    host_layer_fingerprint: existing.host_layer_fingerprint ?? null
+  });
   return {
     from: from_v,
     to: INSTALL_LAYOUT_VERSION,

package/dist/cli-delegate/{chunk-EVTY7ISR.js → chunk-YM4GZDJG.js}

@@ -4230,7 +4230,15 @@ var settingsSchema = external_exports.object({
     ),
     horizon_weeks: external_exports.number().int().min(0).default(0).describe(
       'Optional planning horizon (weeks) the agent shows in roadmap framing ("next 4 weeks"). Set 0 to omit the horizon \u2014 most teams prefer to ship without a hardcoded window.'
-    )
+    ),
+    gate_budget: external_exports.object({
+      max_cost_per_run_usd: external_exports.number().min(0).default(5).describe(
+        "Per-run USD ceiling for a CLASS-1 roadmap blocker executed via `agent-config gates --execute`. A class-1 entry whose **Budget:** field states a larger figure renders its consent line instead of running. Bounds the size of an authorised spend; never supplies the authorisation \u2014 `--confirm` is still required on every class-1 run."
+      ),
+      max_cost_per_rolling_7d_usd: external_exports.number().min(0).default(25).describe(
+        "Rolling 7-day USD ceiling for class-1 gate execution, summed from the append-only receipt ledger at agents/runtime/state/gate-budget-ledger.jsonl. A run whose estimate would cross it renders instead of running. A per-run cap alone bounds one mistake, not a week of them, which is why option (a) of b-gate-budget-preauth carries two numbers."
+      )
+    }).default({ max_cost_per_run_usd: 5, max_cost_per_rolling_7d_usd: 25 })
   }),
   planning: external_exports.object({
     challenge_on_create: external_exports.boolean().default(true).describe(